Cases
Examination workbench
Open a case pack and examine it the way a timeline tool would: every source on one UTC timeline, an activity chart you can brush, pivots on logon IDs, addresses, accounts and paths, logon sessions, failed logons by address, network destinations with bytes, and a findings draft built from the records you tag.
All files are synthetic and served by this site. Your own evidence is never asked for.
Packs on the workbench
| Pack | Sources on the timeline | What to look for | Link |
|---|---|---|---|
| VP-01: Windows triage: the payroll workstation on a Saturday Intermediate · 90 minutes | security-events.csvsystem-events.csvpartition-diagnostic.csvprefetch.csvlnk-files.csv | A Saturday on a payroll workstation: logon sessions, a USB stick, 7-Zip and a backup folder. | Open on the workbench |
| VP-03: Email headers and a message-trace export: a payment change under review Intermediate · 90 minutes | cloud-export.csv | A disputed payment instruction: the cloud mail export next to two raw messages. | Open on the workbench |
| VP-04: Proxy, DNS and DHCP logs: a request to a phishing link Intermediate · 100 minutes | proxy-log.csv (UTC+3)dns-log.csvdhcp-leases.csv | Three clocks: a proxy in local time, DNS and DHCP in UTC, and an address that changes hands. | Open on the workbench |
| VP-05: RDP intrusion on a file server: persistence, data out, a cleared log Advanced · 150 minutes | security-events.csvsysmon-events.csvfirewall-outbound.csv (UTC+3)mft-excerpt.csv | 2,268 Security rows of noise and one session: RDP, persistence, data out and a cleared log. | Open on the workbench |
| VP-06: Ransomware on an accounting workstation: from an attachment to 295 locked files Advanced · 150 minutes | usn-journal.csvsysmon-events.csvsecurity-events.csvdefender-events.csvmail-gateway.csv (UTC+3) | A disk-image attachment, a switched-off antivirus and 295 files renamed in thirteen minutes, read from the USN journal. | Open on the workbench |
| VP-07: Business e-mail compromise in Microsoft 365: a relayed sign-in, a hidden rule and a changed bank account Advanced · 150 minutes | ual-export.csventra-signins.csvmessage-trace.csv | Fourteen mailboxes over four days: one relayed sign-in, a replayed session, a two-dot inbox rule and three sends deleted from Sent Items. | Open on the workbench |
| VP-08: A leaked AWS key and a storage leak: CloudTrail, S3 access logs and a public bucket Advanced · 150 minutes | cloudtrail-events.jsonls3-access-logs.log | One build key, four minutes after it was published: a role session, 294 contracts read, a bucket made public and an archive downloaded by three addresses. | Open on the workbench |
| VP-09: A departing employee: USB, personal cloud, printer and VPN Intermediate · 150 minutes | security-events.csvpartition-diagnostic.csvlnk-files.csvshellbags.csvproxy-log.csvprint-log.csvvpn-sessions.csv (UTC+3) | A month around a resignation: an unapproved stick tied to its files by volume serial number, 38 uploads to a personal cloud, 212 pages printed after hours and a Sunday VPN session into Remote Desktop. | Open on the workbench |
| VP-10: An Android phone, a threatening SMS and an alibi: SMS, call log, usage events and location history Intermediate · 150 minutes | sms.csvcall-log.csv (UTC+3)usage-events.csvTimeline.json | One evening of an Android phone in four exports and three time notations: a threatening SMS, the app in front, five unlocks and location fixes with their radius against an alibi. | Open on the workbench |
How to work on it
Check integrity first
The workbench hashes every file it loads and compares it with the pack's manifest.txt. A mismatch is shown before any event; examine nothing until it is explained.
Fix the time basis
Each source is read on the basis its export metadata states: a firewall or proxy in local time is converted to UTC before it joins the timeline. Change a basis only to see what a wrong one does to the order of events.
Go from the shape to the record
Read the activity chart first: bursts, gaps and night-time work. Drag across a burst to narrow the range, switch categories off, then search or pivot on a logon ID, an address, an account or a path.
Tie sessions together
The Sessions view joins 4624 to 4634/4647 by logon ID and counts every later record that carries the same ID. The failed-logon table groups 4625 by source address with the accounts tried and the reason codes.
Tag, note and draft
Tag a record as Key, Suspicious or Context and add a note. The Findings view turns the tagged records into a Markdown draft with file, row, UTC time, hash table and the time basis used.
Limits
- It reads only the synthetic case-pack files served by this site. It does not accept, upload or process your own evidence.
- It is a training workbench. It does not replace a validated tool chain, a write blocker or your laboratory's procedure.
- Tags and notes are stored in this browser only (localStorage). Clearing the site data removes them; nothing is sent to a server.
- The VP-02 pack is a SQLite database and is examined with a database tool, so it is not listed here.
Contact and service requests
Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.